8.8Alta
KEV
CVE-2010-1871Red Hat Linux JBoss Seam 2 Remote Code Execution Vulnerability
Explotación conocida — Red Hat Linux JBoss Seam 2 Remote Code Execution Vulnerability
CISA confirmó el 10.12.2021 que esta vulnerabilidad se usa en ataques reales. Plazo para las agencias federales de EE. UU.: 10.06.2022.
Acción requerida: Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2010-1871
Descripción
JBoss Seam 2 (jboss-seam2), as used in JBoss Enterprise Application Platform 4.3.0 for Red Hat Linux, does not properly sanitize inputs for JBoss Expression Language (EL) expressions, which allows remote attackers to execute arbitrary code via a crafted URL. NOTE: this is only a vulnerability when the Java Security Manager is not properly configured.
Debilidad (CWE):
CWE-917
Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.
Productos y versiones afectados
| Fabricante | Producto | Versiones | |
|---|---|---|---|
| netapp | oncommand balance | — | |
| netapp | oncommand insight | — | |
| netapp | oncommand unified manager | — | |
| redhat | jboss enterprise application platform | 4.3.0 |
Referencias y parches
- 41994 vdb-entryBroken LinkThird Party AdvisoryVDB Entry
- 20130528 CA20130528-01: Security Notice for CA Process Automation (CA PAM) mailing-listBroken Link
- 1024253 vdb-entryBroken LinkThird Party AdvisoryVDB Entry
- ADV-2010-1929 vdb-entryBroken LinkVendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=615956 Issue Tracking
- seam-expressions-code-execution(60794) vdb-entryThird Party AdvisoryVDB Entry
- RHSA-2010:0564 vendor-advisoryBroken Link
- https://security.netapp.com/advisory/ntap-20161017-0001/ Third Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2010-1871 US Government Resource
Coincidencias CPE (NVD) (4)
cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.3.0:*:*:*:*:*:*:*cpe:2.3:a:netapp:oncommand_balance:-:*:*:*:*:*:*:*cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*cpe:2.3:a:netapp:oncommand_unified_manager:-:*:*:*:*:clustered_data_ontap:*:*